raccoon | 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 02:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
Size 2.6MB
Sample240213-cqwvbsbc34
SHA256 45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503
MD5 38439fdf4744c8a97c0dafce36e4f432
SHA1 e6f56833ecfb2b47f4e39a290bad959776fea2f1
SHA512 69feeaeb83ee5b6773e2919716d9ab2f4acee2f6115ef1731557258f42a5b529760402a091c64be1707a13c4b4cfb09e79ddb0eff24cd3e77fa1e4b355cda407
SSDEEP 49152:01+6+AFUaW+Vvdj8Lf8JtKHibnPIb2qohbLLkYPTRAEOOaS4d5eTovYuLL:XANzVvdw4Jr76oNLpPNAEkeTYpLL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

raccoon 2637bf45ccfc8a2d57025feab0be0b31 stealer

Malware Config

Extracted

Family

raccoon

Botnet

2637bf45ccfc8a2d57025feab0be0b31

http://194.116.173.154:80

Attributes

user_agent
MrBidenNeverKnow

xor.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Raccoon Stealer V2 payload 3 IoCs

resource	yara_rule
behavioral2/memory/4344-19-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4344-22-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2
behavioral2/memory/4344-24-0x0000000000400000-0x0000000000416000-memory.dmp	family_raccoon_v2

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 3 IoCs

resource	yara_rule
behavioral2/memory/4344-19-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4344-22-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4344-24-0x0000000000400000-0x0000000000416000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/memory/1452-0-0x0000000000C60000-0x0000000000F04000-memory.dmp	INDICATOR_EXE_Packed_Fody

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1452 set thread context of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 688	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	83
PID 1452 wrote to memory of 688	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	83
PID 688 wrote to memory of 3184	688	csc.exe	85
PID 688 wrote to memory of 3184	688	csc.exe	85
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86
PID 1452 wrote to memory of 4344	1452	45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe	86

C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe
"C:\Users\Admin\AppData\Local\Temp\45c1e993dbcdef4111153f9c6ad3eb07a1bd8b50cb6164e4d55098412dfd4503.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4a4yfega\4a4yfega.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C47.tmp" "c:\Users\Admin\AppData\Local\Temp\4a4yfega\CSC512FCE1357964537B920876333E762.TMP"
    3⤵
    PID:3184
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  PID:4344

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

4a4yfega.dll

Path C:\Users\Admin\AppData\Local\Temp\4a4yfega\4a4yfega.dll
Size 9KB
SHA256 c56db00a866de7045dcaa0199ec370ed63c835e4cf802c01d24daa474bcdcc48
MD5 06b81eddd4a90678a7ddc7321f25ae00
SHA1 1a46099e8c87be249eced130679d6c393e32a41c
SHA512 3d3e005d011e640a73c2a4accf103c30f8bd2ea5ef47766c324134930f783a4df8afc85063ab8d37bd270069f461169f3c7fb4597534d71b781051eadeabb337
SSDEEP 192:DhMFRixofmpJ1FAlEwM/rTPwrTPwrTPwrTP0PfO7LjLayk5MqEeTO:DqDCOKrErErErP7LjL85Mqn6
MD5 SHA1 SHA512 SSDEEP

Submit Download

RES6C47.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6C47.tmp
Size 1KB
SHA256 d936e54fca01c0a25b2b59b6a4f352f9052bf54419ff6c3736563a658609d168
MD5 7117264cbf318db8e4a1cfbe2f33bf29
SHA1 34646aa3d74fad4f84a80e79010673f652632090
SHA512 80106e3c289af016e46b959e92ce20f4696c6395aa96c878eefed51a8099b3013dec48fcade84a3ecb2f2cd373c2595b4ff9586cae7ad6d30b113db1f4635044
MD5 SHA1 SHA512

Submit Download

4a4yfega.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4a4yfega\4a4yfega.0.cs
Size 10KB
SHA256 463913a4eb1a1ec5b16cc0307e8e3910389e8505a224c695267eeed1c8d5b970
MD5 42cdf76cfeebaa4420881fdb1f349522
SHA1 ef4d59c2b791a84ef78b60dba7ab1aec1b28be1d
SHA512 ed44f969cf64ef7c68df80d09f7c8f96c6e688649995c3e624dcd1638a456a8ef66cc535b40aab43a5679fc676dc62a2160cc49a5d8bc22c7df525bfc5520a7c
SSDEEP 192:qyu5Put/CpQATZ+eqfhyhsch3h1A/Jhxo36t5Hrz4m4:S+/CpQRgsaR1euk5La
MD5 SHA1 SHA512 SSDEEP

Submit Download

4a4yfega.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4a4yfega\4a4yfega.cmdline
Size 204B
SHA256 c2235a5e22f91b77e41efc9b3516fa1963af1e6f95a5aa2696821f945ad98780
MD5 aa368024173004d59fe7726e3ef2c675
SHA1 e5e019af4f51acb8d6e776d2cc5858b546663c29
SHA512 4b05406bbc5d38688b786fb89ea0b574a49a187c58bb220b3c263cee913eb76fc34087fa79f71425dd22c7dc4757c5fa21f6c43a0ccdd187b3296631ed75cf2f
MD5 SHA1 SHA512

Submit Download

CSC512FCE1357964537B920876333E762.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4a4yfega\CSC512FCE1357964537B920876333E762.TMP
Size 652B
SHA256 c1525ce462ba085e83411fa92729015d833569d4138d184e4bd2f85d9399edd9
MD5 a966d9a8f2e4ec6076aad9b66561dc76
SHA1 d3431452a2457137d2ecd56e959131a70fd61c98
SHA512 d605fd60050dfed2950cdd4e93dfa939f6775ad3a2acf6c37c30050d8e9cd8797834767a93a2072d0e6e53645be51e6a341a7119865262a9e6acd36476388f4e
MD5 SHA1 SHA512

Submit Download

memory/1452-3-0x000000001B9F0000-0x000000001BA4E000-memory.dmp

Download

memory/1452-4-0x000000001BB10000-0x000000001BB94000-memory.dmp

Download

memory/1452-0-0x0000000000C60000-0x0000000000F04000-memory.dmp

Download

memory/1452-2-0x000000001BB00000-0x000000001BB10000-memory.dmp

Download

memory/1452-1-0x00007FF91DC30000-0x00007FF91E6F1000-memory.dmp

Download

memory/1452-17-0x000000001BAC0000-0x000000001BAC8000-memory.dmp

Download

memory/1452-23-0x00007FF91DC30000-0x00007FF91E6F1000-memory.dmp

Download

memory/4344-19-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4344-22-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/4344-24-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads